Hi Splunkers,
my search is like that
and it makes table with data and error message.
But error message includes like 50sentences. And I want to show this all sentences in table. But as you can image that table is too long and my dashboard looks like ugly. So i want to show only first 3sentences with arrow or something. Which means when user click arrow show all sentences for error, but before click you can see only 3 sentences.
Can i do this in splunk?
Thanks for help !
This will give you an example of how you can do this with drilldown from your first panel to a second panel where the full message is displayed.
<dashboard>
<label>Test2</label>
<row>
<panel>
<table>
<search>
<query>index=_internal sourcetype=splunkd_ui_access
| rex field=uri "\?(?<path>.*)$"
| eval pos = if(length(path) > 0, length(uri) - length(path), length(uri))
| eval more=if(pos>35,1,0), pos=if(more=1,min(pos,35), min(pos,42))
| eval partial_uri=substr(uri,1, pos - 1)
| eval partial_uri=if(more=1,partial_uri." (..more)", partial_uri)
| eval Date=strftime(_time, "%m-%d-%Y %H:%M:%S")
| table Date partial_uri uri</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<fields>["Date","partial_uri"]</fields>
<drilldown>
<set token="uri">$row.uri$</set>
</drilldown>
</table>
</panel>
</row>
<row depends="$uri$">
<panel>
<html>
<h1>Full error message details</h1>
$uri$
</html>
</panel>
</row>
</dashboard>
thanks for reply!
<fields>["Date","partial_uri"]</fields>
<drilldown>
<set token="uri">$row.uri$</set>
</drilldown>
</table>
</panel>
</row>
<row depends="$uri$">
<panel>
<html>
<h1>Full error message details</h1>
$uri$
I'm still beginner so i have more questions.
Where can i find url?
and
["Date","partial_uri"] , $uri$, $row.uri$ is all same uri ?
thanks in advance 🙂
Tokens are of the form $name$, so $uri$ is a token called uri and it is assigned the contents of the uri field from the search in the drilldown section of the dashboard when it does the set token statement.
Have a read of this, as it will make things clearer (hopefully :))
https://docs.splunk.com/Documentation/Splunk/8.0.4/Viz/PanelreferenceforSimplifiedXML